package console

// The fleets API (fleets.go): account-owned Fleet/FleetBox rows and app
// placement. The properties that matter, in the order they'd hurt if lost:
// a fleet name owned by another account resolves the SAME byte-identical
// 404 an unknown one does (fleet names are one flat, cross-account
// namespace — see fleets.go's package doc), a minted or rotated token's
// plaintext appears exactly once and its stored hash is really its sha256,
// detach flips status without touching the token, and `place` stamps BOTH
// an app's routes and its already-provisioned instance records (the
// tripwire the brief calls out by name) while refusing a target fleet the
// caller does not own.

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"errors"
	"io"
	"net/http"
	"net/url"
	"os"
	"strings"
	"testing"
	"time"

	"github.com/carlosframework/platform/internal/provision"
	"github.com/carlosframework/platform/internal/registry"
	"github.com/carlosframework/platform/internal/release"
	"github.com/carlosframework/platform/internal/status"
)

// fleetFixture is a console with paul (the fixture's default ops-account
// owner, sqid fx.sqid) holding a live CLI token — owner-level, which is
// exactly the gate every fleet door grants (there is no member/owner split
// in this API; the account-scoped 404 is the only gate).
func fleetFixture(t *testing.T, code string) (*consoleFixture, string) {
	t.Helper()
	fx := newConsoleFixture(t)
	return fx, cliToken(t, fx, "paul@keymail.dev", code)
}

func fleetsURL(fx *consoleFixture, acct string) string {
	return fx.ts.URL + "/api/cli/fleets/" + acct
}

// openTestReg opens a second, independent handle on the fixture's registry
// file to seed rows the console API itself has no door for (routes) —
// called before the console's own handlers ever touch this path, so there
// is no cross-connection WAL-staleness risk (registry.go's List/Fingerprint
// doc comment): the console's cached handle (openRegistry, view.go) does
// not exist yet, and every write below is committed before that first call.
func openTestReg(t *testing.T, fx *consoleFixture) *registry.Registry {
	t.Helper()
	reg, err := registry.Open(fx.regPath)
	if err != nil {
		t.Fatal(err)
	}
	return reg
}

// TestFleetCreateListRoundTrip: create, then list, and the created fleet
// comes back with an empty (never null) boxes array.
func TestFleetCreateListRoundTrip(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-roundtrip")
	status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token)
	if status != http.StatusOK {
		t.Fatalf("create = %d %v, want 200", status, body)
	}
	f, ok := body["fleet"].(map[string]any)
	if !ok {
		t.Fatalf("create body = %v, want a \"fleet\" object", body)
	}
	if f["name"] != "acme" || f["bucket"] != "acme-data" {
		t.Fatalf("fleet = %v, want name=acme bucket=acme-data", f)
	}
	boxes, ok := f["boxes"].([]any)
	if !ok || len(boxes) != 0 {
		t.Fatalf("fleet.boxes = %v, want an empty array", f["boxes"])
	}

	status, body = getJSON(t, fleetsURL(fx, fx.sqid), token)
	if status != http.StatusOK {
		t.Fatalf("list = %d %v, want 200", status, body)
	}
	list, ok := body["fleets"].([]any)
	if !ok || len(list) != 1 {
		t.Fatalf("list = %v, want exactly the one fleet", body)
	}
	got := list[0].(map[string]any)
	if got["name"] != "acme" || got["bucket"] != "acme-data" {
		t.Fatalf("listed fleet = %v, want name=acme bucket=acme-data", got)
	}
}

// TestFleetCreateDuplicateName409: the exact "that name is taken" wording
// handleAPICreateApp already uses for the same conflict on apps.
func TestFleetCreateDuplicateName409(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-dup")
	u := fleetsURL(fx, fx.sqid) + "/new"
	if status, body := postJSON(t, u, map[string]string{"name": "acme", "bucket": "bkt-1"}, token); status != http.StatusOK {
		t.Fatalf("first create = %d %v, want 200", status, body)
	}
	status, body := postJSON(t, u, map[string]string{"name": "acme", "bucket": "bkt-2"}, token)
	if status != http.StatusConflict {
		t.Fatalf("duplicate create = %d %v, want 409", status, body)
	}
	if body["error"] != "that name is taken" {
		t.Fatalf("duplicate error = %q, want the exact convention", body["error"])
	}
}

// TestFleetAddBoxTokenHash: the minted token is 64 hex characters, its
// sha256 hex is exactly what landed in the registry row, and it never
// appears anywhere in the create-fleet or list responses.
func TestFleetAddBoxTokenHash(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-addbox")
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}
	status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token)
	if status != http.StatusOK {
		t.Fatalf("add-box = %d %v, want 200", status, body)
	}
	plaintext, _ := body["token"].(string)
	if len(plaintext) != 64 {
		t.Fatalf("token = %q, want 64 hex characters", plaintext)
	}
	if body["label"] != "pi-1" {
		t.Fatalf("label = %v, want pi-1", body["label"])
	}
	sum := sha256.Sum256([]byte(plaintext))
	wantHash := hex.EncodeToString(sum[:])

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].Label != "pi-1" || boxes[0].Status != "active" {
		t.Fatalf("registry boxes = %+v", boxes)
	}
	if boxes[0].TokenHash != wantHash {
		t.Fatalf("stored hash = %s, want sha256(token) = %s", boxes[0].TokenHash, wantHash)
	}
}

// TestFleetRotateBoxChangesHash: a fresh token comes back, distinct from the
// mint's, and the stored hash moves to match it.
func TestFleetRotateBoxChangesHash(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-rotate")
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}
	_, addBody := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes", map[string]string{"label": "pi-1"}, token)
	first, _ := addBody["token"].(string)

	status, rotBody := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes/pi-1/rotate", map[string]string{}, token)
	if status != http.StatusOK {
		t.Fatalf("rotate = %d %v, want 200", status, rotBody)
	}
	second, _ := rotBody["token"].(string)
	if second == "" || second == first {
		t.Fatalf("rotated token = %q, want a fresh 64-hex value distinct from %q", second, first)
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	sum := sha256.Sum256([]byte(second))
	wantHash := hex.EncodeToString(sum[:])
	if len(boxes) != 1 || boxes[0].TokenHash != wantHash {
		t.Fatalf("registry boxes = %+v, want hash %s", boxes, wantHash)
	}
	// The OLD hash no longer matches anything stored.
	oldSum := sha256.Sum256([]byte(first))
	if boxes[0].TokenHash == hex.EncodeToString(oldSum[:]) {
		t.Fatalf("registry still carries the pre-rotation hash")
	}
}

// TestFleetDetachBoxFlipsStatus: detach flips status to "detached" and
// leaves the token hash untouched — rotation and detachment are different
// axes (fleets.go's rotate doc comment).
func TestFleetDetachBoxFlipsStatus(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-detach")
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}
	postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes", map[string]string{"label": "pi-1"}, token)

	status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes/pi-1/detach", map[string]string{}, token)
	if status != http.StatusOK {
		t.Fatalf("detach = %d %v, want 200", status, body)
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].Status != "detached" {
		t.Fatalf("registry boxes = %+v, want status detached", boxes)
	}

	// The list door reflects it too.
	_, listBody := getJSON(t, fleetsURL(fx, fx.sqid), token)
	fleets := listBody["fleets"].([]any)
	f := fleets[0].(map[string]any)
	bx := f["boxes"].([]any)[0].(map[string]any)
	if bx["status"] != "detached" {
		t.Fatalf("listed box status = %v, want detached", bx["status"])
	}
}

// TestAPIFleetTagBox: a full-replace tag write lands in the registry and
// shows up on the list door's "tags" field; bad grammar 400s; an unknown
// label 404s byte-identical to rotate's own unknown-label 404 (both are
// jsonError's "no such box", not the plain apiFleet 404); a foreign-owned
// fleet 404s the ordinary apiFleet way (byte-identical to canonicalNotFound,
// same as every other door in TestFleetCrossAccountAccess404).
func TestAPIFleetTagBox(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-tagbox")
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "pi", "bucket": "pi-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/pi/boxes", map[string]string{"label": "box-a"}, token); status != http.StatusOK {
		t.Fatalf("add-box = %d %v", status, body)
	}

	status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/pi/boxes/box-a/tags",
		map[string]string{"tags": "office,free"}, token)
	if status != http.StatusOK {
		t.Fatalf("tag-box = %d %v, want 200", status, body)
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("pi")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].Tags != "office,free" {
		t.Fatalf("registry boxes = %+v, want tags office,free", boxes)
	}

	_, listBody := getJSON(t, fleetsURL(fx, fx.sqid), token)
	fleets := listBody["fleets"].([]any)
	f := fleets[0].(map[string]any)
	bx := f["boxes"].([]any)[0].(map[string]any)
	if bx["tags"] != "office,free" {
		t.Fatalf("listed box tags = %v, want office,free", bx["tags"])
	}

	// Bad grammar (uppercase) is a 400, and must not have touched the row.
	status, body = postJSON(t, fleetsURL(fx, fx.sqid)+"/pi/boxes/box-a/tags",
		map[string]string{"tags": "Office"}, token)
	if status != http.StatusBadRequest {
		t.Fatalf("bad-grammar tag-box = %d %v, want 400", status, body)
	}
	boxes, err = reg.ListFleetBoxes("pi")
	if err != nil {
		t.Fatal(err)
	}
	if boxes[0].Tags != "office,free" {
		t.Fatalf("registry tags after rejected write = %q, want unchanged office,free", boxes[0].Tags)
	}

	// Unknown label: byte-identical to rotate's own unknown-label 404.
	rotStatus, rotHeader, rotBody := rawReq(t, http.MethodPost, fleetsURL(fx, fx.sqid)+"/pi/boxes/ghost/rotate", token, `{}`)
	tagStatus, tagHeader, tagBody := rawReq(t, http.MethodPost, fleetsURL(fx, fx.sqid)+"/pi/boxes/ghost/tags", token, `{"tags":"x"}`)
	if tagStatus != http.StatusNotFound {
		t.Fatalf("tag-box unknown label = %d, want 404", tagStatus)
	}
	if tagStatus != rotStatus || tagBody != rotBody || tagHeader.Get("Content-Type") != rotHeader.Get("Content-Type") {
		t.Fatalf("tag-box unknown-label 404 = %d %q (%s), want byte-identical to rotate's %d %q (%s)",
			tagStatus, tagBody, tagHeader.Get("Content-Type"), rotStatus, rotBody, rotHeader.Get("Content-Type"))
	}

	// Foreign-owned fleet: the ordinary apiFleet 404, same as every other
	// door in TestFleetCrossAccountAccess404.
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bobToken := cliToken(t, fx, "bob@keymail.dev", "code-fleet-tagbox-bob")
	want := canonicalNotFound(t)
	fStatus, fHeader, fOut := rawReq(t, http.MethodPost, fleetsURL(fx, "cdef")+"/pi/boxes/box-a/tags", bobToken, `{"tags":"x"}`)
	assertNotFound(t, "tag-box on a foreign-owned fleet", want, fStatus, fHeader, fOut)
}

// TestFleetCrossAccountAccess404: a fleet named under the caller's OWN
// account segment but owned by a DIFFERENT account resolves the exact same
// bytes an outright nonexistent fleet name does — fleet names are one flat
// namespace (fleets.go's package doc), so this is the probe surface that
// matters here, distinct from (and in addition to) apiAccount's ordinary
// unknown/foreign-account 404.
func TestFleetCrossAccountAccess404(t *testing.T) {
	fx, ownerToken := fleetFixture(t, "code-fleet-cross-owner")
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, ownerToken); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}

	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bobToken := cliToken(t, fx, "bob@keymail.dev", "code-fleet-cross-bob")

	want := canonicalNotFound(t)
	cases := []struct {
		what, method, url, body string
	}{
		{"list boxes via add-box on a foreign-owned fleet", http.MethodPost, fleetsURL(fx, "cdef") + "/acme/boxes", `{"label":"x"}`},
		{"add-box on a genuinely nonexistent fleet", http.MethodPost, fleetsURL(fx, "cdef") + "/ghost/boxes", `{"label":"x"}`},
		{"rotate on a foreign-owned fleet", http.MethodPost, fleetsURL(fx, "cdef") + "/acme/boxes/pi-1/rotate", `{}`},
		{"detach on a foreign-owned fleet", http.MethodPost, fleetsURL(fx, "cdef") + "/acme/boxes/pi-1/detach", `{}`},
	}
	for _, c := range cases {
		status, h, out := rawReq(t, c.method, c.url, bobToken, c.body)
		assertNotFound(t, c.what, want, status, h, out)
	}

	// Bob's own account is genuinely untouched: an honest fleet of his own
	// still works, proving the refusal above is about OWNERSHIP, not a
	// broken door.
	if status, body := postJSON(t, fleetsURL(fx, "cdef")+"/new", map[string]string{"name": "widget-fleet", "bucket": "w-data"}, bobToken); status != http.StatusOK {
		t.Fatalf("bob's own fleet create = %d %v, want 200", status, body)
	}
}

// TestFleetMissingBearerIs401: every fleet door, and place, answer the same
// 401 with no credential at all.
func TestFleetMissingBearerIs401(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleet-401")
	postJSON(t, fleetsURL(fx, fx.sqid)+"/new", map[string]string{"name": "acme", "bucket": "acme-data"}, token)
	postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes", map[string]string{"label": "pi-1"}, token)

	for _, c := range []struct{ method, url, body string }{
		{http.MethodPost, fleetsURL(fx, fx.sqid) + "/new", `{"name":"x","bucket":"x-data"}`},
		{http.MethodGet, fleetsURL(fx, fx.sqid), ""},
		{http.MethodPost, fleetsURL(fx, fx.sqid) + "/acme/boxes", `{"label":"x"}`},
		{http.MethodPost, fleetsURL(fx, fx.sqid) + "/acme/boxes/pi-1/rotate", `{}`},
		{http.MethodPost, fleetsURL(fx, fx.sqid) + "/acme/boxes/pi-1/detach", `{}`},
		{http.MethodPost, fx.ts.URL + "/api/cli/apps/" + fx.sqid + "/kass/place", `{"target":"fleet/acme"}`},
	} {
		if status, _, out := rawReq(t, c.method, c.url, "", c.body); status != http.StatusUnauthorized {
			t.Errorf("%s %s with no token = %d %s, want 401", c.method, c.url, status, out)
		}
	}
}

// placeURL is the place door for one app under the fixture's own account.
func placeURL(fx *consoleFixture, app string) string {
	return fx.ts.URL + "/api/cli/apps/" + fx.sqid + "/" + app + "/place"
}

// TestAppPlacementFallsBackToRouteWhenStoreEmpty: an app placed by an OLDER
// build — before the store's placement column existed (2026-08-06 ruling) —
// has its placement fact only in its routes, stamped directly rather than
// through handleAPIPlace (which now also writes the store). appPlacement
// must still find it: Store.AppPlacement answers "" for this app, so the
// derivation falls back to walking routes, exactly as it always did before
// the store became the primary source.
func TestAppPlacementFallsBackToRouteWhenStoreEmpty(t *testing.T) {
	fx := newConsoleFixture(t)
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	reg := openTestReg(t, fx)
	if err := reg.Upsert(registry.Route{
		Host: "acme.go.tito.io", Kind: "instance", App: "titogo", Account: fx.sqid, Region: "fleet/pi",
	}); err != nil {
		t.Fatal(err)
	}
	// Sanity: the store genuinely has nothing recorded for this app.
	if p, err := fx.st.AppPlacement(OpsAccountID, "titogo"); err != nil || p != "" {
		t.Fatalf("store placement before appPlacement runs = %q %v, want \"\" (unset)", p, err)
	}

	acct := &Account{ID: OpsAccountID, Sqid: fx.sqid}
	got, err := fx.srv.appPlacement(reg, acct, "titogo")
	if err != nil {
		t.Fatal(err)
	}
	if got != "fleet/pi" {
		t.Fatalf("appPlacement = %q, want the route-derived fleet/pi", got)
	}
}

// TestPlaceStampsRoutesAndInstances is the tripwire test the brief calls out
// by name: placing an app stamps BOTH its routes' Region (walked from the
// registry, SetPlacement per host) AND its already-provisioned instance
// records' Region (provision.SetRecordRegion) — the second half is what
// makes placement real for instances that already exist, not only future
// ones. Clearing (target "") repoints both back to "".
func TestPlaceStampsRoutesAndInstances(t *testing.T) {
	fx, token := fleetFixture(t, "code-place-tripwire")
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}

	// Seed two routes for the app, owned by the fixture account, BEFORE any
	// console fleets/registry call — see openTestReg's doc comment for why
	// that ordering matters.
	reg := openTestReg(t, fx)
	for _, host := range []string{"acme.go.tito.io", "beta.go.tito.io"} {
		if err := reg.Upsert(registry.Route{Host: host, Kind: "instance", App: "titogo", Account: fx.sqid}); err != nil {
			t.Fatal(err)
		}
	}
	// A route for a DIFFERENT app, same account — must be left alone.
	if err := reg.Upsert(registry.Route{Host: "other.go.tito.io", Kind: "instance", App: "otherapp", Account: fx.sqid}); err != nil {
		t.Fatal(err)
	}

	// The fleet target must exist and be owned by the caller.
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "pi", "bucket": "pi-fleet-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}

	// One already-provisioned instance record for the app.
	ctx := context.Background()
	rec := provision.Record{Schema: 1, Host: "acme.go.tito.io", Slug: "acme", App: "titogo", Account: fx.sqid,
		Region: "ie", Channel: "stable", CreatedAt: now.UTC()}
	if err := provision.CreateRecord(ctx, fx.rel, rec); err != nil {
		t.Fatal(err)
	}

	status, body := postJSON(t, placeURL(fx, "titogo"), map[string]string{"target": "fleet/pi"}, token)
	if status != http.StatusOK {
		t.Fatalf("place = %d %v, want 200", status, body)
	}

	for _, host := range []string{"acme.go.tito.io", "beta.go.tito.io"} {
		rt, err := reg.Get(host)
		if err != nil || rt == nil {
			t.Fatalf("route %s: %v", host, err)
		}
		if rt.Region != "fleet/pi" {
			t.Errorf("route %s Region = %q, want fleet/pi", host, rt.Region)
		}
	}
	other, err := reg.Get("other.go.tito.io")
	if err != nil || other == nil {
		t.Fatalf("other-app route: %v", err)
	}
	if other.Region != "" {
		t.Fatalf("a route belonging to a DIFFERENT app was stamped: Region = %q", other.Region)
	}

	got, err := provision.GetRecord(ctx, fx.rel, fx.sqid, "titogo", "acme.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if got.Region != "fleet/pi" {
		t.Fatalf("instance record Region = %q, want fleet/pi — the tripwire: routes-only stamping is not enough", got.Region)
	}
	// Nothing else about the record moved.
	if got.Channel != "stable" || got.Slug != "acme" {
		t.Fatalf("place touched more than Region: %+v", got)
	}

	// Clearing repoints both back to "".
	if status, body := postJSON(t, placeURL(fx, "titogo"), map[string]string{"target": ""}, token); status != http.StatusOK {
		t.Fatalf("clear place = %d %v, want 200", status, body)
	}
	rt, err := reg.Get("acme.go.tito.io")
	if err != nil || rt == nil || rt.Region != "" {
		t.Fatalf("route after clearing: %+v, %v, want Region \"\"", rt, err)
	}
	got, err = provision.GetRecord(ctx, fx.rel, fx.sqid, "titogo", "acme.go.tito.io")
	if err != nil || got.Region != "" {
		t.Fatalf("instance record after clearing: %+v, %v, want Region \"\"", got, err)
	}
}

// vanishOnGetStore wraps a release.Store and deletes ONE key out from under
// itself the first time that key is Get after skip Gets — a stand-in for I4's race: an
// instance record retired (DeleteRecord) in the gap between handleAPIPlace's
// List of a prefix and its per-key SetRecordRegion write reaching that same
// key. Every other key, and every other method, is the embedded Store's real
// behavior untouched.
type vanishOnGetStore struct {
	release.Store
	vanish  string
	skip    int // Gets of vanish to let through first
	deleted bool
}

func (v *vanishOnGetStore) Get(ctx context.Context, key string) ([]byte, string, error) {
	if key == v.vanish && !v.deleted && v.skip > 0 {
		v.skip--
	} else if key == v.vanish && !v.deleted {
		v.deleted = true
		if err := v.Store.Delete(ctx, key); err != nil {
			return nil, "", err
		}
	}
	return v.Store.Get(ctx, key)
}

// TestPlaceSkipsVanishedRecordMidWalk is I4 (final customer-fleets review):
// handleAPIPlace's instance-record walk lists a prefix, then writes each key
// it found. If one of those records is deleted in the gap between the list
// and its own write — SetRecordRegion returns an os.ErrNotExist-wrapped
// error — that must be a logged skip, not a 502 that fails the whole
// placement (and not silently swallowing some OTHER error, which still must
// fail the call). The surviving record must still get stamped.
func TestPlaceSkipsVanishedRecordMidWalk(t *testing.T) {
	fx, token := fleetFixture(t, "code-place-vanish")
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	reg := openTestReg(t, fx)
	for _, host := range []string{"acme.go.tito.io", "ghost.go.tito.io"} {
		if err := reg.Upsert(registry.Route{Host: host, Kind: "instance", App: "titogo", Account: fx.sqid}); err != nil {
			t.Fatal(err)
		}
	}
	if status, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "pi", "bucket": "pi-fleet-data"}, token); status != http.StatusOK {
		t.Fatalf("create fleet = %d %v", status, body)
	}

	ctx := context.Background()
	for _, host := range []string{"acme.go.tito.io", "ghost.go.tito.io"} {
		rec := provision.Record{Schema: 1, Host: host, Slug: strings.SplitN(host, ".", 2)[0], App: "titogo",
			Account: fx.sqid, Channel: "stable", CreatedAt: now.UTC()}
		if err := provision.CreateRecord(ctx, fx.rel, rec); err != nil {
			t.Fatal(err)
		}
	}

	// Swap the server's store for one that deletes ghost's record the
	// instant handleAPIPlace's walk tries to read it — after the List that
	// found it, exactly the race SetRecordRegion's os.ErrNotExist-wrapped
	// return exists to name.
	ghostKey := provision.RecordKey(fx.sqid, "titogo", "ghost.go.tito.io")
	// skip 1: the place's strict read (seedmove.go) reads ghost first.
	fx.srv.cfg.Releases = &vanishOnGetStore{Store: fx.rel, vanish: ghostKey, skip: 1}

	status, body := postJSON(t, placeURL(fx, "titogo"), map[string]string{"target": "fleet/pi"}, token)
	if status != http.StatusOK {
		t.Fatalf("place = %d %v, want 200 (a vanished record mid-walk must not 502 the call)", status, body)
	}

	got, err := provision.GetRecord(ctx, fx.rel, fx.sqid, "titogo", "acme.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if got.Region != "fleet/pi" {
		t.Fatalf("surviving record Region = %q, want fleet/pi — a vanished sibling must not stop the rest of the walk", got.Region)
	}
	if _, err := provision.GetRecord(ctx, fx.rel, fx.sqid, "titogo", "ghost.go.tito.io"); !errors.Is(err, os.ErrNotExist) {
		t.Fatalf("ghost record: %v, want it to stay gone", err)
	}
}

// TestPlaceRefusesForeignFleet: placing onto a fleet owned by a DIFFERENT
// account is refused (the same byte-identical 404 apiFleet gives elsewhere),
// and nothing about the app's routes or instances is touched.
func TestPlaceRefusesForeignFleet(t *testing.T) {
	fx, token := fleetFixture(t, "code-place-foreign")
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	reg := openTestReg(t, fx)
	if err := reg.Upsert(registry.Route{Host: "acme.go.tito.io", Kind: "instance", App: "titogo", Account: fx.sqid}); err != nil {
		t.Fatal(err)
	}
	ctx := context.Background()
	rec := provision.Record{Schema: 1, Host: "acme.go.tito.io", Slug: "acme", App: "titogo", Account: fx.sqid,
		Channel: "stable", CreatedAt: now.UTC()}
	if err := provision.CreateRecord(ctx, fx.rel, rec); err != nil {
		t.Fatal(err)
	}

	// A second account with its OWN fleet, "widgets".
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bobToken := cliToken(t, fx, "bob@keymail.dev", "code-place-foreign-bob")
	if status, body := postJSON(t, fleetsURL(fx, "cdef")+"/new",
		map[string]string{"name": "acme", "bucket": "bob-data"}, bobToken); status != http.StatusOK {
		t.Fatalf("bob's fleet create = %d %v", status, body)
	}

	want := canonicalNotFound(t)
	status, h, out := rawReq(t, http.MethodPost, placeURL(fx, "titogo"), token, `{"target":"fleet/acme"}`)
	assertNotFound(t, "place onto a foreign-owned fleet", want, status, h, out)

	// Nothing moved: not the route, not the record.
	rt, err := reg.Get("acme.go.tito.io")
	if err != nil || rt == nil || rt.Region != "" {
		t.Fatalf("route after a refused place: %+v, %v, want untouched (Region \"\")", rt, err)
	}
	got, err := provision.GetRecord(ctx, fx.rel, fx.sqid, "titogo", "acme.go.tito.io")
	if err != nil || got.Region != "" {
		t.Fatalf("instance record after a refused place: %+v, %v, want untouched (Region \"\")", got, err)
	}
}

// TestPlaceInvalidTargetIs400: a target that doesn't parse as "" or
// "fleet/<name>" is a plain 400, not a 404 — it never reaches the
// fleet-ownership question at all.
func TestPlaceInvalidTargetIs400(t *testing.T) {
	fx, token := fleetFixture(t, "code-place-badtarget")
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	status, body := postJSON(t, placeURL(fx, "titogo"), map[string]string{"target": "eu"}, token)
	if status != http.StatusBadRequest {
		t.Fatalf("place with a bare region code = %d %v, want 400", status, body)
	}
}

// ---- Task 9: the console fleet page (owner view) -------------------------
//
// The properties that matter here, same ordering rule as the API section
// above: a non-member gets the byte-identical 404 an unrouted URL gets, a
// member who isn't the owner sees the same data with no mutation forms, a
// stale heartbeat renders "unreachable" and never its last happy numbers,
// an unjoined registry row (Task 6's KNOWN DEGRADATION carry) renders safely
// rather than crashing or borrowing another row's numbers, and a rotated
// token appears in the response body exactly once, beside the
// detach-not-rotate warning.

// writeFleetHeartbeat lands one box snapshot at
// fleets/<fleet>/status/boxes/<label>.json — the exact path a real fleet
// box's agent writes to (release.NewPrefixStore, host/agent.go) — so the
// page's loader (fleets.go, via status.LoadBoxes over the same prefix
// store) reads it the same way it would in production.
func writeFleetHeartbeat(t *testing.T, fx *consoleFixture, fleet string, b status.Box) {
	t.Helper()
	prefixed := release.NewPrefixStore(fx.rel, "fleets/"+fleet+"/")
	if err := status.WriteBox(context.Background(), prefixed, b); err != nil {
		t.Fatal(err)
	}
}

// postFormHeaders is postForm (server_test.go) plus the response headers —
// needed to assert Cache-Control on the rotate response, which postForm's
// three-value return has no room for.
func postFormHeaders(t *testing.T, c *http.Client, u string, form url.Values) (status int, headers http.Header, body string) {
	t.Helper()
	res, err := c.PostForm(u, form)
	if err != nil {
		t.Fatal(err)
	}
	defer res.Body.Close()
	raw, err := io.ReadAll(res.Body)
	if err != nil {
		t.Fatal(err)
	}
	return res.StatusCode, res.Header, string(raw)
}

// TestFleetPageOwnerControlsMemberReadOnly: both a member and the owner see
// the fleet's boxes — including a fresh box's raw metrics, which this page
// (unlike the public fleet status page) is allowed to show — but only the
// owner's page carries the rotate/detach forms. A member's page must not
// even offer them.
func TestFleetPageOwnerControlsMemberReadOnly(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-owner")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	writeFleetHeartbeat(t, fx, "acme", status.Box{
		GeneratedAt: time.Now(), Label: "pi-1",
		Metrics: &status.BoxMetrics{
			MemTotalBytes: pi64(2 << 30), MemAvailBytes: pi64(1 << 30),
			Load1: p(0.42), DiskFreeBytes: pi64(5 << 30),
			Release: "abc1234", Tunnel: "connected",
		},
	})
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}

	// The owner's view: metrics, and both mutation forms.
	owner := newBrowser(t)
	signUp(t, fx, owner, "code-fleetpage-owner-browser")
	ownerStatus, _, ownerBody := get(t, owner, fx.u("/fleets/acme"))
	if ownerStatus != http.StatusOK {
		t.Fatalf("owner GET /fleets/acme = %d, want 200:\n%s", ownerStatus, ownerBody)
	}
	for _, want := range []string{"pi-1", "connected", "abc1234", "1.0 GB", "2.0 GB", "0.42", "5.0 GB", "Rotate token</button>", "Detach</button>"} {
		if !strings.Contains(ownerBody, want) {
			t.Fatalf("owner fleet page missing %q in:\n%s", want, ownerBody)
		}
	}

	// The member's view: same data, no forms.
	fx.setUser("sam@keymail.dev")
	member := newBrowser(t)
	signUp(t, fx, member, "code-fleetpage-member-browser")
	memberStatus, _, memberBody := get(t, member, fx.u("/fleets/acme"))
	if memberStatus != http.StatusOK {
		t.Fatalf("member GET /fleets/acme = %d, want 200:\n%s", memberStatus, memberBody)
	}
	for _, want := range []string{"pi-1", "connected", "abc1234", "1.0 GB", "2.0 GB", "0.42", "5.0 GB"} {
		if !strings.Contains(memberBody, want) {
			t.Fatalf("member fleet page missing %q in:\n%s", want, memberBody)
		}
	}
	for _, forbidden := range []string{"/fleets/acme/rotate", "/fleets/acme/detach", "Rotate token</button>", "Detach</button>"} {
		if strings.Contains(memberBody, forbidden) {
			t.Fatalf("member fleet page renders a mutation form (%q) it must not have:\n%s", forbidden, memberBody)
		}
	}
}

// TestFleetPageNonMemberGetsIdenticalNotFound: the browser-side twin of
// TestFleetCrossAccountAccess404 — a signed-in caller with no membership in
// the account gets the byte-identical 404 a genuinely unrouted path gets,
// same assertion shape as TestNonMemberGetsIdenticalNotFound.
func TestFleetPageNonMemberGetsIdenticalNotFound(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-nonmember")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	fx.setUser("bob@keymail.dev")
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-bob")

	nonMemberStatus, _, nonMemberBody := get(t, c, fx.u("/fleets/acme"))
	ghostStatus, _, ghostBody := get(t, c, fx.ts.URL+"/definitely-not-a-page")
	if nonMemberStatus != http.StatusNotFound || nonMemberStatus != ghostStatus {
		t.Fatalf("non-member fleet page = %d, unrouted page = %d; want both 404", nonMemberStatus, ghostStatus)
	}
	if nonMemberBody != ghostBody {
		t.Fatalf("non-member fleet page body differs from an unrouted page's:\n%q\n%q", nonMemberBody, ghostBody)
	}
}

// TestFleetPageStaleHeartbeatRendersUnreachable: a heartbeat older than
// 3×status.SnapshotPeriod must never show its last happy numbers — only
// that the box is unreachable and how long it's been dark. Same rule
// TestFleetHostsDetailSuppressesStaleMetrics enforces on the operator page,
// applied here to the customer's own.
func TestFleetPageStaleHeartbeatRendersUnreachable(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-stale")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	writeFleetHeartbeat(t, fx, "acme", status.Box{
		GeneratedAt: time.Now().Add(-time.Hour), Label: "pi-1",
		Metrics: &status.BoxMetrics{
			MemTotalBytes: pi64(9 << 30), MemAvailBytes: pi64(7 << 30),
			Load1: p(8.25), DiskFreeBytes: pi64(3 << 30),
			Release: "beefcaf", Tunnel: "connected",
		},
	})

	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-stale-browser")
	st, _, body := get(t, c, fx.u("/fleets/acme"))
	if st != http.StatusOK {
		t.Fatalf("GET /fleets/acme = %d, want 200:\n%s", st, body)
	}
	if !strings.Contains(body, "unreachable") {
		t.Fatalf("stale box did not render as unreachable:\n%s", body)
	}
	for _, leaked := range []string{"beefcaf", "8.25", "7.0 GB", "9.0 GB", "3.0 GB"} {
		if strings.Contains(body, leaked) {
			t.Fatalf("stale box's last reading %q leaked into the page:\n%s", leaked, body)
		}
	}
}

// TestFleetPageDegradesOnHeartbeatReadFailure: a heartbeat read that FAILS
// (bucket outage, listFailStore below) is not the same claim as "no box has
// ever heartbeated" — the page still renders (boxes list, placed apps, the
// registry rows themselves are all untouched by this failure) but with a
// flash saying the heartbeats specifically could not be read, rather than
// silently collapsing "unknown" into the same "no heartbeat yet" wording an
// honestly-never-joined box gets (TestFleetPageUnjoinedRegistryRowRendersSafely).
func TestFleetPageDegradesOnHeartbeatReadFailure(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-hbfail")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}

	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-hbfail-browser")

	// Swapped in AFTER sign-in and box creation, neither of which touches
	// the release store — only the page's own heartbeat read (status.LoadBoxes,
	// via release.NewPrefixStore) should ever see this failure.
	fx.srv.cfg.Releases = listFailStore{fx.rel}

	st, _, body := get(t, c, fx.u("/fleets/acme"))
	if st != http.StatusOK {
		t.Fatalf("GET /fleets/acme with an unreadable heartbeat store = %d, want 200 (degrade, don't 500):\n%s", st, body)
	}
	// html/template escapes the apostrophe (&#39;) — match around it rather
	// than typing the escaped entity into the test.
	if !strings.Contains(body, "Could not read this fleet") || !strings.Contains(body, "heartbeats.") {
		t.Fatalf("heartbeat read failure did not surface its own flash — page rendered as if nothing were wrong:\n%s", body)
	}
	if !strings.Contains(body, "pi-1") {
		t.Fatalf("the registry's own box row (unaffected by the heartbeat failure) went missing too:\n%s", body)
	}
}

// TestFleetPageUnjoinedRegistryRowRendersSafely is the Task 6 KNOWN
// DEGRADATION carry: a registry box row with no heartbeat that ever joined
// it (pi-2 here — never written at all, standing in for a box heartbeating
// under a hashed pseudonym per the identity ruling) must render as "no
// heartbeat yet", never crash, and never show pi-1's numbers under pi-2's
// label.
func TestFleetPageUnjoinedRegistryRowRendersSafely(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-unjoined")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	for _, label := range []string{"pi-1", "pi-2"} {
		if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
			map[string]string{"label": label}, token); st != http.StatusOK {
			t.Fatalf("add-box %s = %d %v", label, st, body)
		}
	}
	// Only pi-1 ever heartbeats.
	writeFleetHeartbeat(t, fx, "acme", status.Box{
		GeneratedAt: time.Now(), Label: "pi-1",
		Metrics: &status.BoxMetrics{Load1: p(1.11), Tunnel: "connected"},
	})

	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-unjoined-browser")
	st, _, body := get(t, c, fx.u("/fleets/acme"))
	if st != http.StatusOK {
		t.Fatalf("GET /fleets/acme = %d, want 200:\n%s", st, body)
	}
	if !strings.Contains(body, "pi-1") || !strings.Contains(body, "1.11") {
		t.Fatalf("joined box pi-1's own reading missing:\n%s", body)
	}
	if !strings.Contains(body, "pi-2") {
		t.Fatalf("unjoined box pi-2 missing from the page entirely:\n%s", body)
	}
	if !strings.Contains(body, "no heartbeat") {
		t.Fatalf("unjoined box pi-2 did not render as no-heartbeat-yet:\n%s", body)
	}
}

// TestFleetPageRotateWithoutCSRFForbidden: the rotate form is CSRF-gated
// like every other mutation on this console.
func TestFleetPageRotateWithoutCSRFForbidden(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-csrf")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-csrf-browser")
	st, _, _ := postForm(t, c, fx.u("/fleets/acme/rotate"), url.Values{"csrf": {"wrong"}, "label": {"pi-1"}})
	if st != http.StatusForbidden {
		t.Fatalf("rotate with a bad csrf = %d, want 403", st)
	}
}

// TestFleetPageRotateShowsTokenOnceWithWarning: the rotate form's response
// carries the fresh plaintext exactly once, alongside the same
// detach-not-rotate warning printFleetToken (fleets.go, the CLI) gives — and
// the registry's stored hash actually moves to match it, the same tripwire
// TestFleetRotateBoxChangesHash checks at the API layer.
func TestFleetPageRotateShowsTokenOnceWithWarning(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-rotate")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-rotate-browser")
	csrf := sessionToken(t, fx, c)

	st, hdr, body := postFormHeaders(t, c, fx.u("/fleets/acme/rotate"), url.Values{"csrf": {csrf}, "label": {"pi-1"}})
	if st != http.StatusOK {
		t.Fatalf("rotate = %d, want 200 (rendered directly):\n%s", st, body)
	}
	if !strings.Contains(body, "shown once") {
		t.Fatalf("rotate response missing the shown-once notice:\n%s", body)
	}
	if !strings.Contains(strings.ToUpper(body), "NOT REVOCATION") {
		t.Fatalf("rotate response missing the detach-not-rotate warning:\n%s", body)
	}
	// The response body carries a bearer credential — a cached or
	// bfcache/session-restored copy must never keep it around, the same
	// reason writeJSON (authcli.go) sets this on every JSON token response.
	if got := hdr.Get("Cache-Control"); got != "no-store" {
		t.Fatalf("rotate response Cache-Control = %q, want %q", got, "no-store")
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 {
		t.Fatalf("boxes = %+v, want exactly pi-1", boxes)
	}
	// The rendered token, extracted crudely (it's inside a <code> tag), must
	// hash to what's actually stored — proving the page shows the SAME token
	// it wrote, not a decoy.
	found := false
	for _, hexTok := range strings.Fields(strings.ReplaceAll(strings.ReplaceAll(body, "<code>", " "), "</code>", " ")) {
		if len(hexTok) != 64 {
			continue
		}
		sum := sha256.Sum256([]byte(hexTok))
		if hex.EncodeToString(sum[:]) == boxes[0].TokenHash {
			found = true
			break
		}
	}
	if !found {
		t.Fatalf("no 64-hex token in the rotate response hashes to the stored TokenHash %s:\n%s", boxes[0].TokenHash, body)
	}
}

// TestFleetPageTagsChipsRender: a box carrying tags renders each one as its
// own chip, both on the owner's page and a member's — chips are read-only
// display, not a mutation surface, so they belong to the same body a member
// already sees the rest of the row in (TestFleetPageOwnerControlsMemberReadOnly).
// An untagged box renders the em-dash placeholder instead of an empty cell.
func TestFleetPageTagsChipsRender(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-tags-chips")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	for _, label := range []string{"pi-1", "pi-2"} {
		if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
			map[string]string{"label": label}, token); st != http.StatusOK {
			t.Fatalf("add-box %s = %d %v", label, st, body)
		}
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes/pi-1/tags",
		map[string]string{"tags": "office,free"}, token); st != http.StatusOK {
		t.Fatalf("tag-box = %d %v", st, body)
	}

	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-tags-chips-browser")
	st, _, body := get(t, c, fx.u("/fleets/acme"))
	if st != http.StatusOK {
		t.Fatalf("GET /fleets/acme = %d, want 200:\n%s", st, body)
	}
	for _, want := range []string{`<span class="chip chip-env">office</span>`, `<span class="chip chip-env">free</span>`} {
		if !strings.Contains(body, want) {
			t.Fatalf("tagged box missing chip %q in:\n%s", want, body)
		}
	}
	// pi-2 carries no tags: an em-dash, never an empty cell nor pi-1's chips
	// leaking onto its row.
	if !strings.Contains(body, "pi-2") {
		t.Fatalf("untagged box pi-2 missing from the page:\n%s", body)
	}

	// A member sees the same chips (read-only display, no gate on it) but
	// none of the tag form's own markup.
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	member := newBrowser(t)
	signUp(t, fx, member, "code-fleetpage-tags-chips-member")
	memberStatus, _, memberBody := get(t, member, fx.u("/fleets/acme"))
	if memberStatus != http.StatusOK {
		t.Fatalf("member GET /fleets/acme = %d, want 200:\n%s", memberStatus, memberBody)
	}
	for _, want := range []string{`<span class="chip chip-env">office</span>`, `<span class="chip chip-env">free</span>`} {
		if !strings.Contains(memberBody, want) {
			t.Fatalf("member view missing chip %q in:\n%s", want, memberBody)
		}
	}
	if strings.Contains(memberBody, "/fleets/acme/tags") {
		t.Fatalf("member fleet page renders the tag mutation form it must not have:\n%s", memberBody)
	}
}

// TestFleetPageTagBoxOwnerUpdatesAndRedirects: the owner's Tag form performs
// a full-replace write (same as handleAPIFleetTagBox) and redirects back to
// the fleet page with an ordinary ok flash — no secret involved, unlike
// rotate, so there is no reason for this to render directly the way
// handleFleetRotateBoxPage's response does.
func TestFleetPageTagBoxOwnerUpdatesAndRedirects(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-tags-owner")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-tags-owner-browser")
	csrf := sessionToken(t, fx, c)

	status, loc, _ := postForm(t, c, fx.u("/fleets/acme/tags"),
		url.Values{"csrf": {csrf}, "label": {"pi-1"}, "tags": {"office,free"}})
	if status != http.StatusSeeOther || loc != fx.path("/fleets/acme") {
		t.Fatalf("tag-box = %d -> %q, want 303 -> %q", status, loc, fx.path("/fleets/acme"))
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if len(boxes) != 1 || boxes[0].Tags != "office,free" {
		t.Fatalf("registry boxes = %+v, want tags office,free", boxes)
	}

	_, _, body := get(t, c, fx.u("/fleets/acme"))
	if !strings.Contains(body, "Tagged acme/pi-1.") {
		t.Fatalf("no tag flash after redirect:\n%s", body)
	}
	if !strings.Contains(body, `<span class="chip chip-env">office</span>`) {
		t.Fatalf("new tags did not render as chips after the redirect:\n%s", body)
	}
}

// TestFleetPageTagBoxMemberGetsSameRefusalAsRotate: a plain member posting
// the tag form gets the exact same refusal ownerFleet already gives rotate
// and detach — the gate is s.owner (role != RoleOwner -> 404, matching a
// non-member's genuinely-unrouted 404), never a distinguishable 403.
func TestFleetPageTagBoxMemberGetsSameRefusalAsRotate(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-tags-member")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-tags-member-browser")
	csrf := sessionToken(t, fx, c)

	tagStatus, _, tagBody := postForm(t, c, fx.u("/fleets/acme/tags"),
		url.Values{"csrf": {csrf}, "label": {"pi-1"}, "tags": {"office"}})
	rotStatus, _, rotBody := postForm(t, c, fx.u("/fleets/acme/rotate"),
		url.Values{"csrf": {csrf}, "label": {"pi-1"}})
	if tagStatus != http.StatusNotFound {
		t.Fatalf("member tag-box = %d, want 404", tagStatus)
	}
	if tagStatus != rotStatus || tagBody != rotBody {
		t.Fatalf("member tag-box refusal (%d %q) not byte-identical to rotate's (%d %q)",
			tagStatus, tagBody, rotStatus, rotBody)
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if boxes[0].Tags != "" {
		t.Fatalf("member's refused tag POST still wrote tags: %+v", boxes)
	}
}

// TestFleetPageTagBoxWithoutCSRFForbidden: the tag form is CSRF-gated like
// every other mutation on this console — the same 403 rotate's CSRF check
// gives (TestFleetPageRotateWithoutCSRFForbidden).
func TestFleetPageTagBoxWithoutCSRFForbidden(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-tags-csrf")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-tags-csrf-browser")
	st, _, _ := postForm(t, c, fx.u("/fleets/acme/tags"), url.Values{"csrf": {"wrong"}, "label": {"pi-1"}, "tags": {"office"}})
	if st != http.StatusForbidden {
		t.Fatalf("tag-box with a bad csrf = %d, want 403", st)
	}
}

// TestFleetPageTagBoxBadGrammarFlashesErrorNothingWritten: reject, don't
// sanitize — invalid grammar (uppercase, here) never reaches SetFleetBoxTags,
// the same "checked before the write, not after" posture
// handleAPIFleetTagBox already takes, and the flash copy matches Task 2's
// API error text verbatim.
func TestFleetPageTagBoxBadGrammarFlashesErrorNothingWritten(t *testing.T) {
	fx, token := fleetFixture(t, "code-fleetpage-tags-badgrammar")
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "acme", "bucket": "acme-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes",
		map[string]string{"label": "pi-1"}, token); st != http.StatusOK {
		t.Fatalf("add-box = %d %v", st, body)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/acme/boxes/pi-1/tags",
		map[string]string{"tags": "office"}, token); st != http.StatusOK {
		t.Fatalf("seed tag-box = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetpage-tags-badgrammar-browser")
	csrf := sessionToken(t, fx, c)

	status, loc, _ := postForm(t, c, fx.u("/fleets/acme/tags"),
		url.Values{"csrf": {csrf}, "label": {"pi-1"}, "tags": {"Office"}})
	if status != http.StatusSeeOther || loc != fx.path("/fleets/acme") {
		t.Fatalf("bad-grammar tag-box = %d -> %q, want 303 -> %q", status, loc, fx.path("/fleets/acme"))
	}

	_, _, body := get(t, c, fx.u("/fleets/acme"))
	if !strings.Contains(body, "invalid tags — comma-separated [a-z0-9-] (hyphens interior), max 8") {
		t.Fatalf("bad-grammar tag-box did not flash the expected error:\n%s", body)
	}

	reg := openTestReg(t, fx)
	boxes, err := reg.ListFleetBoxes("acme")
	if err != nil {
		t.Fatal(err)
	}
	if boxes[0].Tags != "office" {
		t.Fatalf("registry tags after rejected write = %q, want unchanged office", boxes[0].Tags)
	}
}

// ---- Task 6: the browser placement doors ---------------------------------
//
// Two forms, one mechanism: the app's Instances tab moves THIS app to any of
// the account's fleets (or back to the shared one), and the fleet page moves
// any of the account's apps onto THIS fleet. Both call placeAppTarget, so
// what these tests pin is the doors' own share — the owner gate, CSRF, the
// cross-account 404, the redirect, and that the same routes-and-records
// stamping the CLI API's tests already prove really happened.

// placeFixture is a console with titogo claimed, two of its routes and one
// already-provisioned instance record seeded, and an owned fleet "pi" to
// move it onto. Routes are seeded through a second handle BEFORE the console
// opens its own (openTestReg's doc comment).
func placeFixture(t *testing.T, code string) (*consoleFixture, string) {
	t.Helper()
	fx, token := fleetFixture(t, code)
	now := time.Now()
	if _, err := fx.st.CreateAppIn(OpsAccountID, "titogo", "paul@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	reg := openTestReg(t, fx)
	for _, host := range []string{"acme.go.tito.io", "beta.go.tito.io"} {
		if err := reg.Upsert(registry.Route{Host: host, Kind: "instance", App: "titogo", Account: fx.sqid}); err != nil {
			t.Fatal(err)
		}
	}
	// Region "" throughout: the app starts genuinely unplaced, so "nothing
	// moved" and "moved back to the shared fleet" are the same assertion —
	// assertPlacement can check one value across all three stores. (The API
	// door's own tripwire test covers stamping OVER a pre-existing region.)
	rec := provision.Record{Schema: 1, Host: "acme.go.tito.io", Slug: "acme", App: "titogo",
		Account: fx.sqid, Channel: "stable", CreatedAt: now.UTC()}
	if err := provision.CreateRecord(context.Background(), fx.rel, rec); err != nil {
		t.Fatal(err)
	}
	if st, body := postJSON(t, fleetsURL(fx, fx.sqid)+"/new",
		map[string]string{"name": "pi", "bucket": "pi-fleet-data"}, token); st != http.StatusOK {
		t.Fatalf("create fleet = %d %v", st, body)
	}
	return fx, token
}

// assertPlacement is the whole tripwire in one call: the store of record, the
// app's routes, and its already-provisioned instance record all agree on
// where the app runs. Anything less is the routes-only half-move the API
// door's own tests (TestPlaceStampsRoutesAndInstances) exist to refuse.
func assertPlacement(t *testing.T, fx *consoleFixture, want string) {
	t.Helper()
	if got, err := fx.st.AppPlacement(OpsAccountID, "titogo"); err != nil || got != want {
		t.Fatalf("store placement = %q %v, want %q", got, err, want)
	}
	reg := openTestReg(t, fx)
	for _, host := range []string{"acme.go.tito.io", "beta.go.tito.io"} {
		rt, err := reg.Get(host)
		if err != nil || rt == nil {
			t.Fatalf("route %s: %v", host, err)
		}
		if rt.Region != want {
			t.Fatalf("route %s Region = %q, want %q", host, rt.Region, want)
		}
	}
	got, err := provision.GetRecord(context.Background(), fx.rel, fx.sqid, "titogo", "acme.go.tito.io")
	if err != nil {
		t.Fatal(err)
	}
	if got.Region != want {
		t.Fatalf("instance record Region = %q, want %q", got.Region, want)
	}
}

// TestAppPlacePageMovesAndClears: the owner's Placement form on the app's
// Instances tab stamps routes AND records (placeAppTarget's whole job) and
// comes back to the tab with a flash saying what happened — then clears the
// same way, which is a MOVE BACK to the shared fleet, not a no-op.
func TestAppPlacePageMovesAndClears(t *testing.T) {
	fx, _ := placeFixture(t, "code-appplace-move")
	c := newBrowser(t)
	signUp(t, fx, c, "code-appplace-move-browser")
	csrf := sessionToken(t, fx, c)

	status, loc, _ := postForm(t, c, fx.u("/apps/titogo/place"),
		url.Values{"csrf": {csrf}, "target": {"fleet/pi"}})
	if status != http.StatusSeeOther || loc != fx.path("/apps/titogo/instances") {
		t.Fatalf("place = %d -> %q, want 303 -> %q", status, loc, fx.path("/apps/titogo/instances"))
	}
	assertPlacement(t, fx, "fleet/pi")

	_, _, body := get(t, c, fx.u("/apps/titogo/instances"))
	if !strings.Contains(body, "placed on fleet/pi") {
		t.Fatalf("no placed flash after the redirect:\n%s", body)
	}

	status, loc, _ = postForm(t, c, fx.u("/apps/titogo/place"),
		url.Values{"csrf": {csrf}, "target": {""}})
	if status != http.StatusSeeOther || loc != fx.path("/apps/titogo/instances") {
		t.Fatalf("clear = %d -> %q, want 303 -> %q", status, loc, fx.path("/apps/titogo/instances"))
	}
	assertPlacement(t, fx, "")
	_, _, body = get(t, c, fx.u("/apps/titogo/instances"))
	if !strings.Contains(body, "back on the shared fleet") {
		t.Fatalf("no cleared flash after the redirect:\n%s", body)
	}
}

// TestAppPlacePageMemberRefused: placement is an owner act. A plain member
// gets the same byte-identical 404 every other owner-only app POST gives —
// never a 403 that would confirm the app is there and the caller merely
// under-privileged — and nothing moves.
func TestAppPlacePageMemberRefused(t *testing.T) {
	fx, _ := placeFixture(t, "code-appplace-member")
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	c := newBrowser(t)
	signUp(t, fx, c, "code-appplace-member-browser")
	csrf := sessionToken(t, fx, c)

	status, _, body := postForm(t, c, fx.u("/apps/titogo/place"),
		url.Values{"csrf": {csrf}, "target": {"fleet/pi"}})
	ghostStatus, _, ghostBody := get(t, c, fx.ts.URL+"/definitely-not-a-page")
	if status != http.StatusNotFound || status != ghostStatus || body != ghostBody {
		t.Fatalf("member place = %d %q, want the unrouted page's %d %q", status, body, ghostStatus, ghostBody)
	}
	assertPlacement(t, fx, "")
}

// TestAppPlacePageWithoutCSRFForbidden: the form is CSRF-gated like every
// other mutation on this console.
func TestAppPlacePageWithoutCSRFForbidden(t *testing.T) {
	fx, _ := placeFixture(t, "code-appplace-csrf")
	c := newBrowser(t)
	signUp(t, fx, c, "code-appplace-csrf-browser")

	status, _, _ := postForm(t, c, fx.u("/apps/titogo/place"),
		url.Values{"csrf": {"wrong"}, "target": {"fleet/pi"}})
	if status != http.StatusForbidden {
		t.Fatalf("place with a bad csrf = %d, want 403", status)
	}
	assertPlacement(t, fx, "")
}

// TestAppPlacePageForeignFleetIsIdenticalNotFound: the browser twin of
// TestPlaceRefusesForeignFleet. A target naming a fleet ANOTHER account owns
// must answer exactly what an unrouted URL does — fleet names are one flat,
// cross-account namespace, so a distinguishable refusal here would be a
// cross-account existence oracle.
func TestAppPlacePageForeignFleetIsIdenticalNotFound(t *testing.T) {
	fx, _ := placeFixture(t, "code-appplace-foreign")
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	bobToken := cliToken(t, fx, "bob@keymail.dev", "code-appplace-foreign-bob")
	if st, body := postJSON(t, fleetsURL(fx, "cdef")+"/new",
		map[string]string{"name": "widgets", "bucket": "bob-data"}, bobToken); st != http.StatusOK {
		t.Fatalf("bob's fleet create = %d %v", st, body)
	}

	fx.setUser("paul@keymail.dev")
	c := newBrowser(t)
	signUp(t, fx, c, "code-appplace-foreign-browser")
	csrf := sessionToken(t, fx, c)

	status, _, body := postForm(t, c, fx.u("/apps/titogo/place"),
		url.Values{"csrf": {csrf}, "target": {"fleet/widgets"}})
	ghostStatus, _, ghostBody := get(t, c, fx.ts.URL+"/definitely-not-a-page")
	if status != http.StatusNotFound || status != ghostStatus || body != ghostBody {
		t.Fatalf("place onto a foreign fleet = %d %q, want the unrouted page's %d %q",
			status, body, ghostStatus, ghostBody)
	}
	assertPlacement(t, fx, "")
}

// TestAppInstancesPlacementSection: the tab states where the app runs for
// everyone, and offers the move only to the owner — with the
// data-does-not-move warning beside the form, because "move" is the one word
// a customer could reasonably read as "take my data with it".
func TestAppInstancesPlacementSection(t *testing.T) {
	fx, _ := placeFixture(t, "code-appplace-section")
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	owner := newBrowser(t)
	signUp(t, fx, owner, "code-appplace-section-owner")
	st, _, body := get(t, owner, fx.u("/apps/titogo/instances"))
	if st != http.StatusOK {
		t.Fatalf("GET instances = %d:\n%s", st, body)
	}
	for _, want := range []string{
		"<h2>Placement</h2>",
		"This app runs on the shared fleet.",
		`action="` + fx.path("/apps/titogo/place") + `"`,
		`<option value="fleet/pi"`,
		// The D6 warning, rendered across two source lines — matched in the
		// two halves the template actually emits (and stopped short of the
		// apostrophe html/template escapes).
		"Data does not move:",
		"hibernated instance state stays in the old placement",
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("owner instances tab missing %q in:\n%s", want, body)
		}
	}

	fx.setUser("sam@keymail.dev")
	member := newBrowser(t)
	signUp(t, fx, member, "code-appplace-section-member")
	st, _, memberBody := get(t, member, fx.u("/apps/titogo/instances"))
	if st != http.StatusOK {
		t.Fatalf("member GET instances = %d:\n%s", st, memberBody)
	}
	if !strings.Contains(memberBody, "This app runs on the shared fleet.") {
		t.Fatalf("member instances tab lost the placement statement:\n%s", memberBody)
	}
	if strings.Contains(memberBody, fx.path("/apps/titogo/place")) {
		t.Fatalf("member instances tab renders the move form it must not have:\n%s", memberBody)
	}
}

// TestAppInstancesPlacementShowsFleet: once placed, the tab names the fleet
// and links to its page, and the form's current fleet is the selected option
// rather than a form that reads as "unplaced" over a placed app.
func TestAppInstancesPlacementShowsFleet(t *testing.T) {
	fx, token := placeFixture(t, "code-appplace-shows")
	if st, body := postJSON(t, placeURL(fx, "titogo"), map[string]string{"target": "fleet/pi"}, token); st != http.StatusOK {
		t.Fatalf("place = %d %v", st, body)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-appplace-shows-browser")
	st, _, body := get(t, c, fx.u("/apps/titogo/instances"))
	if st != http.StatusOK {
		t.Fatalf("GET instances = %d:\n%s", st, body)
	}
	if !strings.Contains(body, "/fleets/pi") || !strings.Contains(body, "<code>pi</code>") {
		t.Fatalf("placed app's tab does not name and link its fleet:\n%s", body)
	}
	if !strings.Contains(body, `<option value="fleet/pi" selected>`) {
		t.Fatalf("the current fleet is not the form's selected option:\n%s", body)
	}
}

// TestFleetPagePlaceFormPlacesApp: the fleet page's own form is the same move
// from the other end — pick one of the account's apps, and it lands here.
func TestFleetPagePlaceFormPlacesApp(t *testing.T) {
	fx, _ := placeFixture(t, "code-fleetplace-form")
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetplace-form-browser")
	csrf := sessionToken(t, fx, c)

	st, _, body := get(t, c, fx.u("/fleets/pi"))
	if st != http.StatusOK {
		t.Fatalf("GET fleet page = %d:\n%s", st, body)
	}
	for _, want := range []string{
		`action="` + fx.path("/fleets/pi/place") + `"`,
		`<option value="titogo">titogo</option>`,
		// The D6 warning, rendered across two source lines — matched in the
		// two halves the template actually emits (and stopped short of the
		// apostrophe html/template escapes).
		"Data does not move:",
		"hibernated instance state stays in the old placement",
	} {
		if !strings.Contains(body, want) {
			t.Fatalf("fleet page missing %q in:\n%s", want, body)
		}
	}

	status, loc, _ := postForm(t, c, fx.u("/fleets/pi/place"),
		url.Values{"csrf": {csrf}, "app": {"titogo"}})
	if status != http.StatusSeeOther || loc != fx.path("/fleets/pi") {
		t.Fatalf("fleet place = %d -> %q, want 303 -> %q", status, loc, fx.path("/fleets/pi"))
	}
	assertPlacement(t, fx, "fleet/pi")

	_, _, body = get(t, c, fx.u("/fleets/pi"))
	if !strings.Contains(body, "placed on fleet/pi") {
		t.Fatalf("no placed flash on the fleet page:\n%s", body)
	}
	// The app is now among the placed apps, so it is no longer offered as
	// something to place HERE.
	if strings.Contains(body, `<option value="titogo">titogo</option>`) {
		t.Fatalf("an app already placed on this fleet is still offered as placeable:\n%s", body)
	}
}

// TestFleetPagePlaceFormMemberRefused: same gate as the fleet page's other
// mutations — a member's POST is byte-identical to rotate's refusal.
func TestFleetPagePlaceFormMemberRefused(t *testing.T) {
	fx, _ := placeFixture(t, "code-fleetplace-member")
	if err := fx.st.AddMember(OpsAccountID, "sam@keymail.dev", RoleMember, time.Now()); err != nil {
		t.Fatal(err)
	}
	fx.setUser("sam@keymail.dev")
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetplace-member-browser")
	csrf := sessionToken(t, fx, c)

	placeStatus, _, placeBody := postForm(t, c, fx.u("/fleets/pi/place"),
		url.Values{"csrf": {csrf}, "app": {"titogo"}})
	rotStatus, _, rotBody := postForm(t, c, fx.u("/fleets/pi/rotate"),
		url.Values{"csrf": {csrf}, "label": {"pi-1"}})
	if placeStatus != http.StatusNotFound || placeStatus != rotStatus || placeBody != rotBody {
		t.Fatalf("member fleet place refusal (%d %q) not byte-identical to rotate's (%d %q)",
			placeStatus, placeBody, rotStatus, rotBody)
	}
	assertPlacement(t, fx, "")

	// And the form is not even offered on their page.
	_, _, body := get(t, c, fx.u("/fleets/pi"))
	if strings.Contains(body, fx.path("/fleets/pi/place")) {
		t.Fatalf("member fleet page renders the place form it must not have:\n%s", body)
	}
}

// TestFleetPagePlaceFormForeignApp: an app the account does not claim is the
// same "no such app here" a mistyped app name gets on any other app door —
// the fleet's own ownership having already been proven says nothing about
// the app named in the body.
func TestFleetPagePlaceFormForeignApp(t *testing.T) {
	fx, _ := placeFixture(t, "code-fleetplace-foreignapp")
	now := time.Now()
	if err := fx.st.CreateAccount(42, "cdef", "widgets", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	if _, err := fx.st.CreateAppIn(42, "bobapp", "bob@keymail.dev", now); err != nil {
		t.Fatal(err)
	}
	c := newBrowser(t)
	signUp(t, fx, c, "code-fleetplace-foreignapp-browser")
	csrf := sessionToken(t, fx, c)

	status, _, _ := postForm(t, c, fx.u("/fleets/pi/place"),
		url.Values{"csrf": {csrf}, "app": {"bobapp"}})
	if status != http.StatusNotFound {
		t.Fatalf("placing another account's app = %d, want 404", status)
	}
	if got, err := fx.st.AppPlacement(42, "bobapp"); err != nil || got != "" {
		t.Fatalf("another account's app placement = %q %v, want untouched", got, err)
	}
}